Skip to content

Commit 886f8c0

Browse files
authored
CSOAR-4003: Updated doc for deprecation notice (#5857)
1 parent 2e6694d commit 886f8c0

File tree

2 files changed

+14
-8
lines changed

2 files changed

+14
-8
lines changed

docs/platform-services/automation-service/app-central/integrations/crowdstrike-falcon.md

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,17 +7,16 @@ import useBaseUrl from '@docusaurus/useBaseUrl';
77

88
<img src={useBaseUrl('/img/platform-services/automation-service/app-central/logos/crowdstrike-falcon.png')} alt="crowdstrike-falcon" width="100"/>
99

10-
***Version: 1.17
11-
Updated: July 4, 2025***
10+
***Version: 1.18
11+
Updated: Sept 30, 2025***
1212

13-
The CrowdStrike Falcon integration allows you to pull and update Detections/Incidents, and search Incidents/Devices/Detections.
13+
The CrowdStrike Falcon integration allows you to pull and update Alerts/Incidents, and search Incidents/Devices/Alerts.
1414

1515
## Actions
1616

1717
* **Alerts CrowdStrike Falcon Daemon** *(Daemon)* - Daemon to pull CrowdStrike Alerts.
1818
* **Close CrowdStrike Incident** *(Containment)* - Close the state of the CrowdStrike Incident.
1919
* **Create Indicators** *(Containment)* - Create the Indicators.
20-
* **Detections CrowdStrike Falcon Daemon** *(Daemon)* - Daemon to pull CrowdStrike Detections.
2120
* **Device Actions** *(Containment)* - Take various actions on the hosts in your environment.
2221
* **Get Browser History** *(Enrichment)* - Get user Browser history.
2322
* **Get Endpoint** *(Enrichment)* - Get details on one or more hosts by providing agent IDs.
@@ -30,10 +29,8 @@ The CrowdStrike Falcon integration allows you to pull and update Detections/Inci
3029
* **Query Devices By Filter** *(Enrichment)* - Search for hosts in your environment by platform, hostname, IP, and other criteria.
3130
* **Retrieve Alert Details** *(Enrichment)* - Get details for a specific CrowdStrike Alert.
3231
* **Search into Alerts** *(Enrichment)* - Retrieves all Alerts IDs that match a given query.
33-
* **Search into Detections** *(Enrichment)* - Search for Detections that match a given query.
3432
* **Search into Incidents** *(Enrichment)* - Search for incidents by providing an FQL filter, sorting, and paging
3533
details.
36-
* **Update Detections** *(Containment)* - Modify the state or assignee of Detections.
3734
* **Update Alerts** *(Containment)* - Perform actions on Alerts identified by composite ID(s) in request.
3835

3936
## Category
@@ -57,13 +54,13 @@ import IntegrationTimeout from '../../../../reuse/automation-service/integration
5754

5855
* **User (Client) Secret**. Enter the secret code for the API client, equivalent to a password. The secret is only visible to you at the time the API client is created. After that, it is not retrievable. If your client secret is ever lost, you can reset it to generate a new one.
5956

60-
* **Filter Query (Detections Daemon)**. Enter the FQL-based filter to apply to the search for the detections daemon, for example, `max_severity:>10`
57+
* **Filter Query (Alerts Daemon)**. Enter the FQL-based filter to apply to the search for the Alerts daemon, for example, `max_severity:>10`
6158
* <IntegrationTimeout/>
6259
* <IntegrationCertificate/>
6360
* <IntegrationEngine/>
6461
* <IntegrationProxy/>
6562

66-
<img src={useBaseUrl('/img/platform-services/automation-service/app-central/integrations/crowdstrike/crowdstrike-falcon-configuration.png')} style={{border:'1px solid gray'}} alt="CrowdStrike Falcon configuration" width="400"/>
63+
<img src={useBaseUrl('/img/platform-services/automation-service/app-central/integrations/crowdstrike/crowdstrike-falcon-configuration1.png')} style={{border:'1px solid gray'}} alt="CrowdStrike Falcon configuration1" width="400"/>
6764

6865
For information about CrowdStrike Falcon, see [CrowdStrike documentation](https://www.crowdstrike.com/en-us/resources/guides/?lang=1).
6966

@@ -103,3 +100,12 @@ For information about CrowdStrike Falcon, see [CrowdStrike documentation](https:
103100
* Retrieve Alert Details
104101
* July 4, 2025 (v1.17) - Added new action
105102
* Query Devices By Filter
103+
* Sept 30, 2025 (v1.18) - CrowdStrike has deprecated Detections-based APIs, and these actions have now been replaced with Alerts-based actions to align with the latest API updates. Please migrate to the Alerts actions to ensure continued functionality.
104+
* Deprecated Actions:
105+
+ Update Detections
106+
+ Search into Detections
107+
+ Detections CrowdStrike Falcon Daemon
108+
* Replacement Actions:
109+
+ Update Alerts
110+
+ Search into Alerts
111+
+ Alerts CrowdStrike Falcon Daemon
121 KB
Loading

0 commit comments

Comments
 (0)